{"id":"CVE-2026-49346","aliases":["ALPINE-CVE-2026-49346","BELL-CVE-2026-49346","DEBIAN-CVE-2026-49346","EUVD-2026-38080","GHSA-vv8h-932h-7r86","JLSEC-2026-790","MGASA-2026-0420","ROOT-OS-DEBIAN-11-CVE-2026-49346","ROOT-OS-DEBIAN-12-CVE-2026-49346","ROOT-OS-DEBIAN-13-CVE-2026-49346","UBUNTU-CVE-2026-49346","USN-8573-1"],"status":"published","title":"libde265 has a heap buffer overflow in de265_image_get_buffer via SPS dimension integer overflow","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00371,"percentile":0.31321,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-06-19T20:12:14Z","modified":"2026-10-28T11:16:28Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"libde265","fixed_in":["1.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libde265","fixed_in":["1.1.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libde265","fixed_in":["1.0.11-1+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libde265","fixed_in":["1.0.15-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libde265","fixed_in":["1.1.1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"libde265_jll","fixed_in":["1.1.0+0"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"libde265","fixed_in":["1.0.11-0+deb11u4.aikido.13"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-libde265","fixed_in":["1.0.11-0+deb11u4.aikido.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libde265","fixed_in":["1.0.2-2ubuntu0.16.04.1~esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libde265","fixed_in":["1.0.2-2ubuntu0.18.04.1~esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libde265","fixed_in":["1.0.4-1ubuntu0.4+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libde265","fixed_in":["1.0.8-1ubuntu0.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libde265","fixed_in":["1.0.15-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libde265","fixed_in":["1.0.16-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.16-r0"},{"fixed":"1.1.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.11-1+deb12u3"}]}],"versions":["1.0.11-1","1.0.11-1+deb12u1","1.0.11-1+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.15-1+deb13u1"}]}],"versions":["1.0.15-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1"}]}],"versions":["1.0.15-1","1.0.16-1","1.0.18-1"]},{"source":"osv","ecosystem":"Julia","package":"libde265_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.16-4.1.mga10"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:10","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.16-4.1.mga10.tainted"}]}],"bundled":12},{"source":"osv","ecosystem":"Root:Debian:11","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.11-0+deb11u4.aikido.13"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.11-0+deb11u4.aikido.13"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2ubuntu0.16.04.1~esm6"}]}],"versions":["1.0.2-1build1","1.0.2-2","1.0.2-2ubuntu0.16.04.1~esm1","1.0.2-2ubuntu0.16.04.1~esm2","1.0.2-2ubuntu0.16.04.1~esm3","1.0.2-2ubuntu0.16.04.1~esm4","1.0.2-2ubuntu0.16.04.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2ubuntu0.18.04.1~esm6"}]}],"versions":["1.0.2-2build1","1.0.2-2ubuntu0.18.04.1~esm1","1.0.2-2ubuntu0.18.04.1~esm2","1.0.2-2ubuntu0.18.04.1~esm3","1.0.2-2ubuntu0.18.04.1~esm4","1.0.2-2ubuntu0.18.04.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-1ubuntu0.4+esm2"}]}],"versions":["1.0.3-1build1","1.0.4-1","1.0.4-1build1","1.0.4-1ubuntu0.1","1.0.4-1ubuntu0.2","1.0.4-1ubuntu0.3","1.0.4-1ubuntu0.4","1.0.4-1ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-1ubuntu0.3+esm2"}]}],"versions":["1.0.8-1","1.0.8-1ubuntu0.1","1.0.8-1ubuntu0.2","1.0.8-1ubuntu0.3","1.0.8-1ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.15-1ubuntu0.1"}]}],"versions":["1.0.12-2","1.0.13-1","1.0.15-1","1.0.15-1build1","1.0.15-1build2","1.0.15-1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.15-1build5","1.0.16-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.16-1ubuntu0.1~esm1"}]}],"versions":["1.0.16-1","1.0.16-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2ubuntu0.16.04.1~esm6"}]}],"versions":["1.0.2-1build1","1.0.2-2","1.0.2-2ubuntu0.16.04.1~esm1","1.0.2-2ubuntu0.16.04.1~esm2","1.0.2-2ubuntu0.16.04.1~esm3","1.0.2-2ubuntu0.16.04.1~esm4","1.0.2-2ubuntu0.16.04.1~esm5"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2ubuntu0.18.04.1~esm6"}]}],"versions":["1.0.2-2build1","1.0.2-2ubuntu0.18.04.1~esm1","1.0.2-2ubuntu0.18.04.1~esm2","1.0.2-2ubuntu0.18.04.1~esm3","1.0.2-2ubuntu0.18.04.1~esm4","1.0.2-2ubuntu0.18.04.1~esm5"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-1ubuntu0.4+esm2"}]}],"versions":["1.0.3-1build1","1.0.4-1","1.0.4-1build1","1.0.4-1ubuntu0.1","1.0.4-1ubuntu0.2","1.0.4-1ubuntu0.3","1.0.4-1ubuntu0.4","1.0.4-1ubuntu0.4+esm1"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-1ubuntu0.3+esm2"}]}],"versions":["1.0.8-1","1.0.8-1ubuntu0.1","1.0.8-1ubuntu0.2","1.0.8-1ubuntu0.3","1.0.8-1ubuntu0.3+esm1"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.15-1ubuntu0.1"}]}],"versions":["1.0.12-2","1.0.13-1","1.0.15-1","1.0.15-1build1","1.0.15-1build2","1.0.15-1build3"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.16-1ubuntu0.1~esm1"}]}],"versions":["1.0.16-1","1.0.16-1build1"],"bundled":12}],"products":[{"vendor":"struktur","product":"libde265"},{"vendor":"strukturag","product":"libde265"}],"references":[{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-49346","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-49346","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49346.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49346","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-49346","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0420.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35987","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8573-1","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/issues/460","tags":["report"]},{"url":"https://github.com/strukturag/libde265/issues/484","tags":["report"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-wqrf-6rf5-v78r","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-653q-9f73-8hvg","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-wg9q-ppqw-6q38","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-ccfw-29x7-rrx3","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-j2qq-x2xq-g9wr","tags":["advisory"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00324.html","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00397.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-49346","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38949","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38950","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-61147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33165","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45382","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45383","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-49295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-49337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-54240","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-54241","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-49346","title":"libde265 has a heap buffer overflow in de265_image_get_buffer via SPS dimension integer overflow","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.","status":"published","published":"2026-06-19T20:12:14.958Z","modified":"2026-06-22T14:05:14.851Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T13:34:59.78118Z"}],"euvd":[{"id":"EUVD-2026-38080","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.","status":"published","published":"2026-06-19T20:12:14Z","modified":"2026-06-22T14:05:14Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:35.26548Z"}],"nvd":[{"id":"CVE-2026-49346","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.","status":"published","published":"2026-06-19T21:17:01.847Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"ALPINE-CVE-2026-49346","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.","status":"published","published":"2026-06-19T21:17:01.847Z","modified":"2026-10-23T18:30:03.120882314Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-49346","status":"published","published":"2026-06-23T06:12:37.256749Z","modified":"2026-06-28T07:15:41.664528282Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:24.391068Z"},{"id":"CVE-2026-49346","title":"libde265 has a heap buffer overflow in de265_image_get_buffer via SPS dimension integer overflow","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.","status":"published","published":"2026-06-19T20:12:14.958Z","modified":"2026-10-28T11:16:28.098633273Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:45:07.060148Z"},{"id":"DEBIAN-CVE-2026-49346","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.","status":"published","published":"2026-06-19T21:17:01.847Z","modified":"2026-10-26T11:47:36.001453791Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"JLSEC-2026-790","title":"A malicious h.265 bitstream can cause integer overflow and out of bounds writes in libde265","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.","status":"published","published":"2026-07-25T03:23:36.599Z","modified":"2026-07-25T03:30:03.612065063Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"UBUNTU-CVE-2026-49346","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.","status":"published","published":"2026-06-19T21:17:00Z","modified":"2026-07-21T13:09:21.500533306Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"MGASA-2026-0420","title":"Updated libde265 package fixes security vulnerabilities","description":"Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers\nto crash the application via crafted payload to display444as420 function\nat sdl.cc. (CVE-2024-38949)\nHeap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers\nto crash the application via crafted payload to __interceptor_memcpy\nfunction. (CVE-2024-38950)\nstrukturag libde265 commit d9fea9d wa discovered to contain a\nsegmentation fault via the component\ndecoder_context::compute_framedrop_table(). (CVE-2025-61147)\nNULL Pointer Dereference in libde265. (CVE-2026-33164)\nHeap out-of-bounds write in libde265 1.0.16. (CVE-2026-33165)\nlibde265 has a heap-buffer-overflow READ in decode_slice_unit_tiles via\nunvalidated PPS tile geometry. (CVE-2026-45382)\nlibde265 has a heap buffer overflow (OOB read) in\ndecode_slice_unit_WPP() via out-of-bounds CtbAddrRStoTS access —\nlibde265 \u003c= v1.0.18. (CVE-2026-45383)\nlibde265 has an out-of-bounds write in process_reference_picture_set via\npredicted short-term RPS. (CVE-2026-49295)\nlibde265 has an unbounded memory leak via orphaned slice headers in\n`read_slice_NAL`. (CVE-2026-49337)\nlibde265 has a heap buffer overflow in de265_image_get_buffer via SPS\ndimension integer overflow. (CVE-2026-49346)\nPixel accessor signed integer overflow causes heap OOB read/write.\n(CVE-2026-54240)\nSAO sequential filter heap buffer overflow via signed integer overflow.\n(CVE-2026-54241)\n","status":"published","published":"2026-09-20T04:25:32Z","modified":"2026-09-20T04:30:03.388103105Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-49346","title":"CVE-2026-49346 in libde265 - Patched by Root","description":"Root has patched CVE-2026-49346 in the libde265 package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-09-11T06:52:13Z","modified":"2026-09-11T07:15:07.685681511Z","updated_at":"2026-11-02T15:53:30.179841Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-49346","title":"CVE-2026-49346 in libde265 - Patched by Root","description":"Root has patched CVE-2026-49346 in the libde265 package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-25T11:02:16Z","modified":"2026-10-01T08:00:06.892730418Z","updated_at":"2026-11-02T15:53:32.298225Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-49346","title":"CVE-2026-49346 in libde265 - Patched by Root","description":"Root has patched CVE-2026-49346 in the libde265 package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-24T16:09:31Z","modified":"2026-10-01T08:00:06.059490572Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"USN-8573-1","title":"libde265 vulnerabilities","description":"It was discovered that libde265 did not properly manage memory under\ncertain circumstances. An attacker could possibly use this issue to\ncause libde265 to crash, resulting in a denial of service. This issue\nonly affected Ubuntu 22.04 LTS. (CVE-2023-51792)\n\nIt was discovered that libde265 did not properly handle certain\nmalformed media files, leading to a heap buffer overflow. An attacker\ncould possibly use this issue to cause libde265 to crash, resulting in\na denial of service. (CVE-2024-38949, CVE-2024-38950)\n\nIt was discovered that libde265 did not properly handle certain\nmalformed input, leading to a segmentation fault. An attacker could\npossibly use this issue to cause libde265 to crash, resulting in a\ndenial of service. (CVE-2025-61147)\n\nIt was discovered that libde265 did not properly handle a malformed\nH.265 PPS NAL unit, leading to a segmentation fault. An attacker could\npossibly use this issue to cause libde265 to crash, resulting in a\ndenial of service. (CVE-2026-33164)\n\nIt was discovered that libde265 did not properly handle certain\ncrafted HEVC bitstreams, leading to an out-of-bounds write. An attacker\ncould possibly use this issue to cause libde265 to crash, resulting in\na denial of service. (CVE-2026-33165)\n\nValentin Mercier discovered that libde265 did not properly validate\ntile geometry when handling crafted media files, leading to an\nout-of-bounds read. An attacker could possibly use this issue to cause\nlibde265 to crash, resulting in a denial of service, or to obtain\nsensitive information. (CVE-2026-45382)\n\nIt was discovered that libde265 did not properly validate certain\nvalues when decoding crafted media files, leading to an out-of-bounds\nread. An attacker could possibly use this issue to cause libde265 to\ncrash, resulting in a denial of service, or to obtain sensitive\ninformation. (CVE-2026-45383)\n\nYing Dong discovered that libde265 did not properly validate reference\npicture set entries when handling a crafted H.265 bitstream, leading to\nan out-of-bounds write. An attacker could possibly use this issue to\ncause libde265 to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2026-49295)\n\nYing Dong discovered that libde265 did not properly manage memory when\nhandling a crafted sequence of H.265 NAL units, leading to excessive\nmemory consumption. An attacker could possibly use this issue to cause\nlibde265 to use excessive resources, leading to a denial of service.\n(CVE-2026-49337)\n\nYing Dong discovered that libde265 did not properly handle certain\ncrafted H.265 bitstreams with large dimensions, leading to a heap\nbuffer overflow. An attacker could possibly use this issue to cause\nlibde265 to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2026-49346)\n\nIt was discovered that libde265 did not properly handle certain crafted\nHEVC bitstreams with large dimensions, leading to an out-of-bounds\nread and write. An attacker could possibly use this issue to cause\nlibde265 to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2026-54240)\n\nIt was discovered that libde265 did not properly handle certain crafted\nHEVC bitstreams with large dimensions, leading to a heap buffer\noverflow. An attacker could possibly use this issue to cause libde265\nto crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2026-54241)","status":"published","published":"2026-07-20T19:21:39Z","modified":"2026-09-14T11:17:38.296060606Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}